test(config): assert update_config threads enable_tls into render

update_config always renders patroni.yml with enable_tls=is_tls_enabled, but
the orchestration tests mocked render_patroni_yml_file without checking that
kwarg, so a regression hardcoding or inverting the TLS flag would still pass.
Pin that the flag reaches the render call for both the enabled and disabled
states.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>

Author: marceloneppel

tests/unit/test_config_manager.py

@@ -792,6 +792,18 @@ def test_update_config_no_peers_returns_true_early(orchestrate, postgresql_clien
     orchestrate.handle_restart_need.assert_not_called()
 
 
+def test_update_config_threads_tls_flag_into_render(orchestrate, postgresql_client):
+    """is_tls_enabled is what update_config passes as render_patroni_yml_file's enable_tls."""
+    orchestrate._is_tls.return_value = True
+    orchestrate.update_config(postgresql_client, user_hash="uh", no_peers=True)
+    assert orchestrate.render_patroni_yml_file.call_args.kwargs["enable_tls"] is True
+
+    orchestrate.render_patroni_yml_file.reset_mock()
+    orchestrate._is_tls.return_value = False
+    orchestrate.update_config(postgresql_client, user_hash="uh", no_peers=True)
+    assert orchestrate.render_patroni_yml_file.call_args.kwargs["enable_tls"] is False
+
+
 def test_update_config_workload_not_running_persists_tls_and_refreshes(
     orchestrate, postgresql_client
 ):